7 files changed, 19 insertions, 17 deletions

diff --git a/src/plugins/dpdk/ipsec/esp_encrypt.c b/src/plugins/dpdk/ipsec/esp_encrypt.c
index cd751d34e6b..af0e4b6211b 100644
--- a/src/plugins/dpdk/ipsec/esp_encrypt.c
+++ b/src/plugins/dpdk/ipsec/esp_encrypt.c
@@ -283,8 +283,9 @@ dpdk_esp_encrypt_inline (vlib_main_t * vm,
 
 	  if (PREDICT_FALSE (esp_seq_advance (sa0)))
 	    {
-	      clib_warning ("sequence number counter has cycled SPI %u",
-			    sa0->spi);
+	      clib_warning
+		("sequence number counter has cycled SPI %u (0x%08x)",
+		 sa0->spi, sa0->spi);
 	      if (is_ip6)
 		vlib_node_increment_counter (vm,
 					     dpdk_esp6_encrypt_node.index,
diff --git a/src/vnet/ipsec/ah_encrypt.c b/src/vnet/ipsec/ah_encrypt.c
index 1be4b3af7b7..75294a23102 100644
--- a/src/vnet/ipsec/ah_encrypt.c
+++ b/src/vnet/ipsec/ah_encrypt.c
@@ -75,8 +75,8 @@ format_ah_encrypt_trace (u8 * s, va_list * args)
   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
   ah_encrypt_trace_t *t = va_arg (*args, ah_encrypt_trace_t *);
 
-  s = format (s, "ah: sa-index %d spi %u seq %u:%u integrity %U",
-	      t->sa_index, t->spi, t->seq_hi, t->seq_lo,
+  s = format (s, "ah: sa-index %d spi %u (0x%08x) seq %u:%u integrity %U",
+	      t->sa_index, t->spi, t->spi, t->seq_hi, t->seq_lo,
 	      format_ipsec_integ_alg, t->integ_alg);
   return s;
 }
diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index cf485482c0e..c879a404b54 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -78,11 +78,12 @@ format_esp_encrypt_trace (u8 * s, va_list * args)
   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
   esp_encrypt_trace_t *t = va_arg (*args, esp_encrypt_trace_t *);
 
-  s = format (s, "esp: sa-index %d spi %u seq %u crypto %U integrity %U%s",
-	      t->sa_index, t->spi, t->seq,
-	      format_ipsec_crypto_alg, t->crypto_alg,
-	      format_ipsec_integ_alg, t->integ_alg,
-	      t->udp_encap ? " udp-encap-enabled" : "");
+  s =
+    format (s,
+	    "esp: sa-index %d spi %u (0x%08x) seq %u crypto %U integrity %U%s",
+	    t->sa_index, t->spi, t->spi, t->seq, format_ipsec_crypto_alg,
+	    t->crypto_alg, format_ipsec_integ_alg, t->integ_alg,
+	    t->udp_encap ? " udp-encap-enabled" : "");
   return s;
 }
 
diff --git a/src/vnet/ipsec/esp_format.c b/src/vnet/ipsec/esp_format.c
index 615d576043b..48b728dd196 100644
--- a/src/vnet/ipsec/esp_format.c
+++ b/src/vnet/ipsec/esp_format.c
@@ -23,10 +23,10 @@ u8 *
 format_esp_header (u8 * s, va_list * args)
 {
   esp_header_t *esp = va_arg (*args, esp_header_t *);
+  u32 spi = clib_net_to_host_u32 (esp->spi);
 
-  s = format (s, "ESP: spi %u, seq %u",
-	      clib_net_to_host_u32 (esp->spi),
-	      clib_net_to_host_u32 (esp->seq));
+  s = format (s, "ESP: spi %u (0x%08x), seq %u",
+	      spi, spi, clib_net_to_host_u32 (esp->seq));
   return s;
 }
 
diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c
index 1e6e2d5cb01..1c3c5f95262 100644
--- a/src/vnet/ipsec/ipsec_format.c
+++ b/src/vnet/ipsec/ipsec_format.c
@@ -287,8 +287,8 @@ format_ipsec_sa (u8 * s, va_list * args)
 
   sa = pool_elt_at_index (im->sad, sai);
 
-  s = format (s, "[%d] sa 0x%x spi %u mode %s%s protocol %s %U",
-	      sai, sa->id, sa->spi,
+  s = format (s, "[%d] sa 0x%x spi %u (0x%08x) mode %s%s protocol %s %U",
+	      sai, sa->id, sa->spi, sa->spi,
 	      ipsec_sa_is_set_IS_TUNNEL (sa) ? "tunnel" : "transport",
 	      ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? "-ip6" : "",
 	      sa->protocol ? "esp" : "ah", format_ipsec_sa_flags, sa->flags);
diff --git a/src/vnet/ipsec/ipsec_if_in.c b/src/vnet/ipsec/ipsec_if_in.c
index 9565078b3b9..d1f9d5c3ad3 100644
--- a/src/vnet/ipsec/ipsec_if_in.c
+++ b/src/vnet/ipsec/ipsec_if_in.c
@@ -59,7 +59,7 @@ format_ipsec_if_input_trace (u8 * s, va_list * args)
   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
   ipsec_if_input_trace_t *t = va_arg (*args, ipsec_if_input_trace_t *);
 
-  s = format (s, "IPSec: spi %u seq %u", t->spi, t->seq);
+  s = format (s, "IPSec: spi %u (0x%08x) seq %u", t->spi, t->spi, t->seq);
   return s;
 }
 
diff --git a/src/vnet/ipsec/ipsec_input.c b/src/vnet/ipsec/ipsec_input.c
index 778570a41d4..cfbda318851 100644
--- a/src/vnet/ipsec/ipsec_input.c
+++ b/src/vnet/ipsec/ipsec_input.c
@@ -61,9 +61,9 @@ format_ipsec_input_trace (u8 * s, va_list * args)
   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
   ipsec_input_trace_t *t = va_arg (*args, ipsec_input_trace_t *);
 
-  s = format (s, "%U: sa_id %u spd %u policy %d spi %u seq %u",
+  s = format (s, "%U: sa_id %u spd %u policy %d spi %u (0x%08x) seq %u",
 	      format_ip_protocol, t->proto, t->sa_id,
-	      t->spd, t->policy_index, t->spi, t->seq);
+	      t->spd, t->policy_index, t->spi, t->spi, t->seq);
 
   return s;
 }